diff --git a/.github/workflows/ci_cortex_m.yml b/.github/workflows/ci_cortex_m.yml
index ab7cc7923..933c950fb 100644
--- a/.github/workflows/ci_cortex_m.yml
+++ b/.github/workflows/ci_cortex_m.yml
@@ -54,14 +54,18 @@ jobs:
       GCC_TARGET: arm-none-eabi
 
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
     - name: Cache the Arm GNU toolchain
       id: cache-arm-gcc
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: toolchain
         key: arm-gnu-toolchain-${{ env.GCC_VERSION }}-x86_64-${{ env.GCC_TARGET }}
diff --git a/.github/workflows/clang_check.yml b/.github/workflows/clang_check.yml
index e791f82e9..405033f0b 100644
--- a/.github/workflows/clang_check.yml
+++ b/.github/workflows/clang_check.yml
@@ -27,12 +27,16 @@ jobs:
       ATFE_VERSION: 22.1.0
 
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Cache Arm Toolchain for Embedded
       id: cache-atfe
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: atfe
         key: atfe-${{ env.ATFE_VERSION }}-linux-x86_64
diff --git a/.github/workflows/ports_arch_check.yml b/.github/workflows/ports_arch_check.yml
index 589ef372c..334a53864 100644
--- a/.github/workflows/ports_arch_check.yml
+++ b/.github/workflows/ports_arch_check.yml
@@ -35,8 +35,12 @@ jobs:
     # supplied: token" and the check never evaluated anything. The default
     # GITHUB_TOKEN is enough to check out a public repository, and the
     # repository has no submodules.
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Check the port trees: the generated ports must be reproducible from
     # ports_arch, and no port header may be left unbalanced or carrying code
@@ -60,7 +64,7 @@ jobs:
     # GITHUB_TOKEN is enough to check out a public repository, and the
     # repository has no submodules.
     - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Regenerate the A profile ports and fail if anything changed, which means
     # a generated port was edited directly instead of ports_arch.
diff --git a/.github/workflows/regression_template.yml b/.github/workflows/regression_template.yml
index 27666ae7d..62a28e937 100644
--- a/.github/workflows/regression_template.yml
+++ b/.github/workflows/regression_template.yml
@@ -62,8 +62,12 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+    # Actions are pinned to a commit SHA, with the version in the trailing
+    # comment. A tag can be moved; a SHA cannot, so this is what makes "which
+    # code ran in CI" answerable from the repository. Dependabot moves these
+    # pins and rewrites the comment with them -- see .github/dependabot.yml.
     - name: Check out the repository
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         submodules: true
 
@@ -84,7 +88,7 @@ jobs:
       run: ${{ inputs.test_script }}
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2.11.0
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
       if: always()
       with:
         check_name: Test Results ${{ inputs.result_affix }}
@@ -93,7 +97,7 @@ jobs:
 
     - name: Upload Test Results
       if: success() || failure()
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: test_reports ${{ inputs.result_affix }}
         path: |
@@ -102,7 +106,7 @@ jobs:
           ${{ inputs.cmake_path }}/build/**/regression/output_files/*.bin
 
     - name: Configure GitHub Pages
-      uses: actions/configure-pages@v5.0.0
+      uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
     # The coverage steps below run even when a test failed. cmake_bootstrap.sh
     # now produces the report in that case, and the run whose behaviour changed
@@ -113,7 +117,7 @@ jobs:
     # ! opens a YAML tag, and the expression will not parse without it.
     - name: Generate Code Coverage Results Summary
       if: ${{ !cancelled() && (!inputs.skip_coverage) }}
-      uses: irongut/CodeCoverageSummary@v1.3.0
+      uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
       with:
         filename: ${{ inputs.cmake_path }}/coverage_report/${{ inputs.coverage_name }}.xml
         format: markdown
@@ -129,7 +133,7 @@ jobs:
 
     - name: Create CheckRun for Code Coverage
       if: ${{ !cancelled() && ((github.event_name == 'push') || (github.event_name == 'workflow_dispatch') || (github.event.pull_request.head.repo.full_name == github.repository)) && (!inputs.skip_coverage) }}
-      uses: LouisBrunner/checks-action@v2.0.0
+      uses: LouisBrunner/checks-action@937cbbcde3259005b50746dc91cde29098aac2ff # v3.1.0
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         name: Code Coverage ${{ inputs.result_affix }}
@@ -140,7 +144,7 @@ jobs:
 
     - name: Add Code Coverage PR Comment
       if: ${{ !cancelled() && ((github.event_name == 'push') || (github.event.pull_request.head.repo.full_name == github.repository)) && (!inputs.skip_coverage) }}
-      uses: marocchino/sticky-pull-request-comment@v2.9.4
+      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
       with:
         header: Code Coverage ${{ inputs.result_affix }}
         path: code-coverage-results.md
@@ -160,7 +164,7 @@ jobs:
       run: echo "coverage_report=coverage_report-$(date +%s)" >> $GITHUB_OUTPUT
 
     - name: Upload Code Coverage Artifacts
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: ${{ !cancelled() && (inputs.skip_deploy && !inputs.skip_coverage) }}
       with:
           name: ${{ steps.artifact.outputs.coverage_report }}
@@ -168,7 +172,7 @@ jobs:
           retention-days: 1
 
     - name: Upload Code Coverage Pages
-      uses: actions/upload-pages-artifact@v3.0.1
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
       if: ${{ !cancelled() && (!inputs.skip_deploy && !inputs.skip_coverage) }}
       with:
         path: ${{ inputs.cmake_path }}/coverage_report/${{ inputs.coverage_name }}
@@ -211,7 +215,7 @@ jobs:
     # the merge means one overwrites the other. That file is consumed by
     # CodeCoverageSummary back in run_tests and is not read here, so this is
     # untidy rather than wrong.
-    - uses: actions/download-artifact@v4.3.0
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       if: ${{ inputs.skip_test }}
       with:
         pattern: coverage_report-*
@@ -219,7 +223,7 @@ jobs:
         path: ${{ inputs.cmake_path }}/coverage_report
 
     - name: Upload Code Coverage Pages
-      uses: actions/upload-pages-artifact@v3.0.1
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
       if: ${{ inputs.skip_test }}
       with:
         path: .
@@ -231,13 +235,13 @@ jobs:
     # is why that went unnoticed; retention-days: 1 on the upload is what has
     # actually been clearing these up.
     - name: Delete Duplicate Code Coverage Artifact
-      uses: geekyeggo/delete-artifact@v5.1.0
+      uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
       with:
           name: coverage_report-*
 
     - name: Deploy GitHub Pages site
       id: deployment
-      uses: actions/deploy-pages@v4.0.5
+      uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
 
     - name: Write Code Coverage Report URL
       run: >-